A crafted Extended Communities attribute triggers a NULL
pointer dereference which causes the BGP daemon to crash.
The crafted attributes are not propagated by the Internet
core, so only explicitly configured direct peers are able
to exploit this vulnerability in typical configurations.

The BGP daemon resets BGP sessions when it encounters
malformed AS_PATHLIMIT attributes, introducing a distributed
BGP session reset vulnerability which disrupts packet
forwarding. Such malformed attributes are propagated by the
Internet core, and exploitation of this vulnerability is not
restricted to directly configured BGP peers.

This security update removes AS_PATHLIMIT processing from the BGP
implementation, preserving the configuration statements for backwards
compatibility. (Standardization of this BGP extension was abandoned
long ago.)

For the oldstable distribution (lenny), these problems have been fixed
in version 0.99.10-1lenny5.

For the stable distribution (squeeze), these problems have been fixed
in version 0.99.17-2+squeeze2.

For the testing distribution (wheezy) and the unstable distribution
(sid), these problems will be fixed soon.